PRIVACY
NOTICE.
How C3SA collects, uses and protects personal information when you visit c3sa.com, contact us or use our interactive tools. Last updated November 10, 2026.
Looking for help protecting your own organization’s data? See our Privacy Engineering & Data Protection services.
WHO WE ARE
C3SA Cyber Security Audit (“C3SA”, “we”) operates c3sa.com. Our head office is at 1730 St Laurent Blvd, Suite 800, Ottawa, Ontario K1G 3Y7, Canada. We also have offices in The Hague, the Netherlands, and Austin, Texas.
Our person in charge of the protection of personal information is Jarett Parent, Chief Executive Officer, reachable at privacy@c3sa.com.
WHAT WE COLLECT AND WHY
When you contact us
Our contact and incident-response forms are provided by Zoho Forms. We collect what you enter, such as your name, organization, email address, phone number and message, and use it to respond to you, provide the services you ask about and keep a record of our conversation. Submissions go directly to our Zoho CRM; the website itself does not store them.
Website analytics (only with your consent)
If you accept analytics, we use Zoho PageSense to understand how visitors use the site: pages viewed, clicks, scrolling, the device and browser you use, your approximate location and how you arrived. We use this to improve the site’s content and navigation. PageSense uses cookies and similar technologies to do this. If you decline, it does not load.
Live chat and visitor insights (only with your consent)
If you accept, we use Zoho SalesIQ to offer live chat and to see which pages a visitor has viewed so we can respond in context. If you chat with us or give us your details, SalesIQ may link that activity to you. SalesIQ uses cookies and similar technologies. If you decline, it does not load.
Interactive tools
Our assessment tools process your answers in your browser. If analytics is on, the site records an anonymous completion event (the tool’s name and score). Your contact details and full results are only sent to C3SA if you choose to submit them.
Security and site operation
Our hosting and security providers (Cloudflare and Zoho Catalyst) process technical data such as IP addresses and request logs to deliver the site and protect it from attacks. This happens whether or not you accept analytics.
YOUR CHOICES
Analytics and chat stay off until you accept them. You can change your mind at any time with , also linked at the bottom of every page. If your browser sends a Global Privacy Control signal, we treat it as a refusal unless you opt in.
We keep your choice in your browser’s local storage so we don’t ask on every page.
WHO WE SHARE IT WITH
We do not sell personal information. We share it only with service providers that help us run the site and our business, under contracts that require them to protect it: Zoho Corporation (Forms, CRM, PageSense, SalesIQ, Catalyst hosting) and Cloudflare (content delivery and security). We may also disclose information where the law requires it.
WHERE IT IS STORED
Our Zoho services are hosted in Zoho’s Canadian data centre. Some providers, including Cloudflare, may process data in other countries, including the United States and the European Union. Where we transfer personal information outside Canada or the European Economic Area, we rely on contractual and other safeguards to protect it.
HOW LONG WE KEEP IT
Contact information is held in our Zoho CRM, where we apply the following retention periods. We keep enquiries that do not lead to an engagement for up to three years after our last interaction. Where an enquiry becomes a client engagement, we keep related records for as long as our contract and the law require, generally up to seven years after the engagement ends. We keep website analytics data for 26 months. When information is no longer needed, we delete or anonymize it.
YOUR RIGHTS
Depending on where you live, you can ask to access, correct or delete your personal information, withdraw consent, or object to or restrict how we use it. To make a request, email privacy@c3sa.com. We will respond within the time the law requires.
If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, or, in the European Union, your local data protection authority (in the Netherlands, the Autoriteit Persoonsgegevens).
CHANGES TO THIS NOTICE
We will update this notice when our practices change and show the date of the latest version at the top.